fix_gpc_magic() is invoked from common.inc::_drupal_bootstrap_full() at DRUPAL_BOOTSTRAP_FULL time.

However, this function is not invoked when page cache is enabled. I believe this is a potential source of problems because superglobals may still be accessed from hook_init() or hook_exit().

Comments

chx’s picture

chx commented
Status: Active » Closed (won't fix)

it's a performance hit for very little gain. you call if you need it. It can be called multiple times freely.

markus_petrux’s picture

markus_petrux commented

So... is Drupal fine with non sanitized superglobals when page cache is enabled?

What if a contrib module (from hook_init/exit) needs to access a superglobals then?

markus_petrux’s picture

markus_petrux commented

sorry, where I said "sanitized" please read "normalized".

Is it a documentation issue? I mean, something like "if you need to access a superglobal when page cache is enabled then, you need to invoke fix_gpc_magic() yourself"...